WordPress Plugin 4.5.2 data Vulnerability Issue

This flags up my previous repeated requests for the V3D export locally option to ONLY export the essential required HTML app files and none of the V3D, Blender and other unused files –

As a non-coder, the export locally option is very un “Artist Friendly”, as there is no clear explanation as to which files are required for the HTML app only – it is not an easy task at all to go through the exported files and try and work out what are the actual HTML app files, and what are the puzzle files and blender files etc –

PLEASE can you make the export locally option respect the option that is made checkable in the app manager “general settings”? I really don’t understand why this hasn’t been done – it makes no sense at all, and now with this vulnerability issue, it would help resolve this if the upload app manager in WordPress was only uploading a known set of file types because the exported app locally only contains the required files for a website. If that makes sense?

Alexander Kovelenov wrote:

Hi,

We did some investigation and have some updates.

This looks scary on the first site, but in reality only privileged users can exploit this vulnerability (such as admins and sales staff).

I guess the guys who opened this issue just used some tool to scan the plugin code and posted the results.

Anyway, we are working to get rid of this issue altogether!

Hi Alexander, Thanks for the update. Yes, that’s actually how I interpreted the threat as well, and for me, as a sole admin, that wouldn’t really be a problem, but I guess for sites with multiple users, this could be alarming.

However, as per my follow up messages after the OP, I still do think this highlights the absolutely essential requirement for V3D app manager to have the ability to locally export a “clean” set of application only required files (without any non application specific files), so that the average user like myself can feel confident they are only uploading the required web app files and nothing else – this really is a super critical change as far as I am concerned.

Thanks for updating!

• This reply was modified 3 months, 3 weeks ago by PLAN8.

Alexander Kovelenov wrote:

PLAN8 wrote:

However, as per my follow up messages after the OP, I still do think this highlights the absolutely essential requirement for V3D app manager to have the ability to locally export a “clean” set of application only required files (without any non application specific files)

We’ll definitely look at this also!